diff --git a/reference/mysql/functions/mysql-real-escape-string.xml b/reference/mysql/functions/mysql-real-escape-string.xml index bc5d18135b..e26638de4d 100644 --- a/reference/mysql/functions/mysql-real-escape-string.xml +++ b/reference/mysql/functions/mysql-real-escape-string.xml @@ -1,5 +1,5 @@ - + @@ -106,10 +106,16 @@ SELECT * FROM users WHERE name='aidan' AND password='' OR 1=1 This would allow anyone to log in without a valid password. + + + + + A "Best Practice" query Using mysql_real_escape_string around each variable - prevents this. This example demonstrates the proper method for querying a database, - independent of the Magic Quotes setting. + prevents SQL Injection. This example demonstrates the "best practice" + method for querying a database, independent of the + Magic Quotes setting.